Apache CouchDB CVE-2026-90798

The attacker must be an authenticated owner of a CouchDB replication source or target (PR:L) and must control that endpoint so it returns an infinite HTTP redirect loop; the missing circuit-breaker in the replicator then follows redirects without bound. Exploitation is limited to Apache CouchDB 3.5.2 and earlier and requires valid credentials plus control over a replication endpoint's HTTP responses (AT:P) - it cannot be triggered by an unauthenticated or purely external attacker, and only availability of the replication function is affected.

This is a low-priority issue despite being network-reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores only 0.6, and every signal reinforces low real-world risk: the only impact is a low-level availability hit (VA:L) with no confidentiality or integrity impact and no scope/subsequent-system change (SC:N/SI:N/SA:L). PR:L means the actor must already be an authenticated owner of a replication source or target - this is an authorized-user self-inflicted or privileged-abuse DoS, not an anonymous remote attack. The vector's own exploit-maturity metric is E:U (exploit unproven), and there is no CISA KEV listing, no EPSS value supplied, and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' AT:P (attack requirements present) further signals that non-default, attacker-controlled conditions are needed. No signals conflict here - low CVSS, unproven exploit, no KEV, authenticated-only, and availability-only impact all agree this is a minor hardening fix, not an urgent priority. Note: EPSS and CWE are both absent from the input (CWE: N/A), so probabilistic exploitation likelihood and formal weakness classification could not be cross-referenced.

An authenticated CouchDB user who owns a replication source or target configures that endpoint to return an endless chain of HTTP redirects. Because the replicator lacks a circuit-breaker, it follows the redirect loop indefinitely, consuming resources and degrading availability. No public exploit code is known, and the impact is limited to a self-contained denial of service against the replication subsystem.